denchclaw 2.0.0 → 2.0.2

package/dist/program-DSR-Zphq.js

@@ -0,0 +1,2412 @@
+import { c as hasFlag, d as applyCliProfileEnv, f as expandHomePrefix, i as defaultRuntime, p as resolveRequiredHomeDir, s as getPrimaryCommand, t as isTruthyEnvValue, u as hasRootVersionAlias } from "./entry.js";
+import { a as hasEmittedCliBanner, c as theme, i as formatCliBannerLine, n as resolveCliName, o as VERSION, s as isRich, t as replaceCliName } from "./cli-name-8WJ6gVD5.js";
+import { execFileSync, spawn } from "node:child_process";
+import process$1 from "node:process";
+import os from "node:os";
+import path from "node:path";
+import fs, { copyFileSync, cpSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { Command } from "commander";
+import { confirm, isCancel, spinner } from "@clack/prompts";
+import { fileURLToPath } from "node:url";
+import { createConnection } from "node:net";
+
+//#region src/infra/ports-lsof.ts
+const LSOF_CANDIDATES = process.platform === "darwin" ? ["/usr/sbin/lsof", "/usr/bin/lsof"] : ["/usr/bin/lsof", "/usr/sbin/lsof"];
+function resolveLsofCommandSync() {
+	for (const candidate of LSOF_CANDIDATES) try {
+		fs.accessSync(candidate, fs.constants.X_OK);
+		return candidate;
+	} catch {}
+	return "lsof";
+}
+
+//#endregion
+//#region src/utils.ts
+/**
+* Escapes special regex characters in a string so it can be used in a RegExp constructor.
+*/
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function resolveUserPath(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return trimmed;
+	if (trimmed.startsWith("~")) {
+		const expanded = expandHomePrefix(trimmed, {
+			home: resolveRequiredHomeDir(process.env, os.homedir),
+			env: process.env,
+			homedir: os.homedir
+		});
+		return path.resolve(expanded);
+	}
+	return path.resolve(trimmed);
+}
+function resolveConfigDir(env = process.env, homedir = os.homedir) {
+	const override = env.OPENCLAW_STATE_DIR?.trim() || env.CLAWDBOT_STATE_DIR?.trim();
+	if (override) return resolveUserPath(override);
+	const newDir = path.join(resolveRequiredHomeDir(env, homedir), ".openclaw");
+	try {
+		if (fs.existsSync(newDir)) return newDir;
+	} catch {}
+	return newDir;
+}
+function formatTerminalLink(label, url, opts) {
+	const esc = "\x1B";
+	const safeLabel = label.replaceAll(esc, "");
+	const safeUrl = url.replaceAll(esc, "");
+	if (!(opts?.force === true ? true : opts?.force === false ? false : Boolean(process.stdout.isTTY))) return opts?.fallback ?? `${safeLabel} (${safeUrl})`;
+	return `\u001b]8;;${safeUrl}\u0007${safeLabel}\u001b]8;;\u0007`;
+}
+const CONFIG_DIR = resolveConfigDir();
+
+//#endregion
+//#region src/cli/ports.ts
+function parseLsofOutput(output) {
+	const lines = output.split(/\r?\n/).filter(Boolean);
+	const results = [];
+	let current = {};
+	for (const line of lines) if (line.startsWith("p")) {
+		if (current.pid) results.push(current);
+		current = { pid: Number.parseInt(line.slice(1), 10) };
+	} else if (line.startsWith("c")) current.command = line.slice(1);
+	if (current.pid) results.push(current);
+	return results;
+}
+function listPortListeners(port) {
+	try {
+		return parseLsofOutput(execFileSync(resolveLsofCommandSync(), [
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-FpFc"
+		], { encoding: "utf-8" }));
+	} catch (err) {
+		const status = err.status;
+		if (err.code === "ENOENT") throw new Error("lsof not found; required for --force", { cause: err });
+		if (status === 1) return [];
+		throw err instanceof Error ? err : new Error(String(err));
+	}
+}
+
+//#endregion
+//#region src/terminal/links.ts
+const DOCS_ROOT = "https://docs.openclaw.ai";
+function formatDocsLink(path, label, opts) {
+	const trimmed = path.trim();
+	const url = trimmed.startsWith("http") ? trimmed : `${DOCS_ROOT}${trimmed.startsWith("/") ? trimmed : `/${trimmed}`}`;
+	return formatTerminalLink(label ?? url, url, {
+		fallback: opts?.fallback ?? url,
+		force: opts?.force
+	});
+}
+
+//#endregion
+//#region src/terminal/prompt-style.ts
+const stylePromptMessage = (message) => isRich() ? theme.accent(message) : message;
+
+//#endregion
+//#region src/cli/web-runtime.ts
+const DEFAULT_WEB_APP_PORT = 3100;
+const WEB_RUNTIME_DIRNAME = "web-runtime";
+const WEB_RUNTIME_APP_DIRNAME = "app";
+const WEB_RUNTIME_MANIFEST_FILENAME = "manifest.json";
+const WEB_RUNTIME_PROCESS_FILENAME = "process.json";
+const WEB_APP_PROBE_ATTEMPTS = 20;
+const WEB_APP_PROBE_DELAY_MS = 750;
+const WEB_APP_PROBE_TIMEOUT_MS = 1500;
+const LEGACY_STANDALONE_SEGMENT = "/apps/web/.next/standalone/apps/web";
+function normalizePathForMatch(value) {
+	return value.replaceAll("\\", "/").toLowerCase();
+}
+function isPathWithin(parentDir, candidatePath) {
+	const relative = path.relative(path.resolve(parentDir), path.resolve(candidatePath));
+	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function parseOptionalPositiveInt(value) {
+	if (value === void 0) return;
+	const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return;
+	return parsed;
+}
+function ensureParentDir(filePath) {
+	mkdirSync(path.dirname(filePath), { recursive: true });
+}
+function readJsonFile(filePath) {
+	if (!existsSync(filePath)) return null;
+	try {
+		return JSON.parse(readFileSync(filePath, "utf-8"));
+	} catch {
+		return null;
+	}
+}
+function writeJsonFile(filePath, value) {
+	ensureParentDir(filePath);
+	writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
+}
+function isProcessAlive(pid) {
+	try {
+		process$1.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code !== "ESRCH";
+	}
+}
+async function terminatePidWithEscalation(pid) {
+	try {
+		process$1.kill(pid, "SIGTERM");
+	} catch (error) {
+		if (error.code === "ESRCH") return;
+		throw error;
+	}
+	for (let i = 0; i < 8; i += 1) {
+		if (!isProcessAlive(pid)) return;
+		await sleep$1(100);
+	}
+	if (!isProcessAlive(pid)) return;
+	try {
+		process$1.kill(pid, "SIGKILL");
+	} catch (error) {
+		if (error.code === "ESRCH") return;
+		throw error;
+	}
+	for (let i = 0; i < 8; i += 1) {
+		if (!isProcessAlive(pid)) return;
+		await sleep$1(100);
+	}
+}
+function resolveCliPackageRoot() {
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 5; i += 1) {
+		if (existsSync(path.join(dir, "package.json"))) return dir;
+		dir = path.dirname(dir);
+	}
+	return process$1.cwd();
+}
+function resolveProfileStateDir(profile, env = process$1.env) {
+	const home = resolveRequiredHomeDir(env, os.homedir);
+	return path.join(home, ".openclaw-dench");
+}
+function resolveManagedWebRuntimeDir(stateDir) {
+	return path.join(stateDir, WEB_RUNTIME_DIRNAME);
+}
+function resolveManagedWebRuntimeAppDir(stateDir) {
+	return path.join(resolveManagedWebRuntimeDir(stateDir), WEB_RUNTIME_APP_DIRNAME);
+}
+function resolveManagedWebRuntimeServerPath(stateDir) {
+	return path.join(resolveManagedWebRuntimeAppDir(stateDir), "server.js");
+}
+function resolveManagedWebRuntimeManifestPath(stateDir) {
+	return path.join(resolveManagedWebRuntimeDir(stateDir), WEB_RUNTIME_MANIFEST_FILENAME);
+}
+function resolveManagedWebRuntimeProcessPath(stateDir) {
+	return path.join(resolveManagedWebRuntimeDir(stateDir), WEB_RUNTIME_PROCESS_FILENAME);
+}
+function resolvePackagedStandaloneServerPath(packageRoot) {
+	return path.join(packageRoot, "apps/web/.next/standalone/apps/web/server.js");
+}
+function resolvePackagedStandaloneAppDir(packageRoot) {
+	return path.dirname(resolvePackagedStandaloneServerPath(packageRoot));
+}
+function readManagedWebRuntimeManifest(stateDir) {
+	return readJsonFile(resolveManagedWebRuntimeManifestPath(stateDir));
+}
+function readManagedWebRuntimeProcess(stateDir) {
+	return readJsonFile(resolveManagedWebRuntimeProcessPath(stateDir));
+}
+function writeManagedWebRuntimeManifest(stateDir, manifest) {
+	writeJsonFile(resolveManagedWebRuntimeManifestPath(stateDir), manifest);
+	return manifest;
+}
+function writeManagedWebRuntimeProcess(stateDir, processMeta) {
+	writeJsonFile(resolveManagedWebRuntimeProcessPath(stateDir), processMeta);
+}
+function clearManagedWebRuntimeProcess(stateDir) {
+	rmSync(resolveManagedWebRuntimeProcessPath(stateDir), { force: true });
+}
+function updateManifestLastPort(stateDir, webPort, gatewayPort) {
+	const manifest = readManagedWebRuntimeManifest(stateDir);
+	if (!manifest) return null;
+	return writeManagedWebRuntimeManifest(stateDir, {
+		...manifest,
+		lastPort: webPort,
+		lastGatewayPort: gatewayPort
+	});
+}
+function evaluateWebProfilesPayload(payload) {
+	if (!payload || typeof payload !== "object") return {
+		ok: false,
+		reason: "response payload is not an object"
+	};
+	const data = payload;
+	if (!(Array.isArray(data.profiles) ? data.profiles : Array.isArray(data.workspaces) ? data.workspaces : void 0)) return {
+		ok: false,
+		reason: "response payload missing profiles/workspaces array"
+	};
+	if ((data.activeProfile === null || typeof data.activeProfile === "string" ? data.activeProfile : data.activeWorkspace === null || typeof data.activeWorkspace === "string" ? data.activeWorkspace : void 0) === void 0) return {
+		ok: false,
+		reason: "response payload missing active profile/workspace field"
+	};
+	return {
+		ok: true,
+		reason: "profiles payload shape is valid"
+	};
+}
+async function probeWebRuntime(port) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), WEB_APP_PROBE_TIMEOUT_MS);
+	try {
+		const response = await fetch(`http://127.0.0.1:${port}/api/profiles`, {
+			method: "GET",
+			signal: controller.signal,
+			redirect: "manual"
+		});
+		if (response.status < 200 || response.status >= 400) return {
+			ok: false,
+			status: response.status,
+			reason: `/api/profiles returned status ${response.status}`
+		};
+		const evaluation = evaluateWebProfilesPayload(await response.json().catch(() => null));
+		return {
+			ok: evaluation.ok,
+			status: response.status,
+			reason: evaluation.reason
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			reason: (error instanceof Error ? error.message : String(error)) || "probe failed"
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function waitForWebRuntime(port) {
+	let lastResult = {
+		ok: false,
+		reason: "web runtime did not respond"
+	};
+	for (let attempt = 0; attempt < WEB_APP_PROBE_ATTEMPTS; attempt += 1) {
+		const result = await probeWebRuntime(port);
+		if (result.ok) return result;
+		lastResult = result;
+		await sleep$1(WEB_APP_PROBE_DELAY_MS);
+	}
+	return lastResult;
+}
+function classifyWebPortListener(params) {
+	if (!params.cwd) return "foreign";
+	if (isPathWithin(params.managedRuntimeAppDir, params.cwd)) return "managed";
+	if (normalizePathForMatch(params.cwd).includes(LEGACY_STANDALONE_SEGMENT)) return "legacy-standalone";
+	return "foreign";
+}
+function parseSemverMajor(version) {
+	if (!version) return null;
+	const match = version.trim().match(/^v?(\d+)(?:\.\d+)?(?:\.\d+)?(?:[-+].*)?$/u);
+	if (!match) return null;
+	const major = Number.parseInt(match[1], 10);
+	if (!Number.isFinite(major)) return null;
+	return major;
+}
+function evaluateMajorVersionTransition(params) {
+	const previousMajor = parseSemverMajor(params.previousVersion);
+	const currentMajor = parseSemverMajor(params.currentVersion);
+	return {
+		previousMajor,
+		currentMajor,
+		isMajorTransition: previousMajor !== null && currentMajor !== null && previousMajor !== currentMajor
+	};
+}
+function resolveProcessCwd(pid) {
+	try {
+		const output = execFileSync(resolveLsofCommandSync(), [
+			"-nP",
+			"-a",
+			"-p",
+			String(pid),
+			"-d",
+			"cwd",
+			"-Fn"
+		], { encoding: "utf-8" });
+		for (const line of output.split(/\r?\n/)) if (line.startsWith("n")) {
+			const cwd = line.slice(1).trim();
+			if (cwd.length > 0) return cwd;
+		}
+		return;
+	} catch {
+		return;
+	}
+}
+function inspectWebPortListeners(port, stateDir) {
+	if (process$1.env.VITEST === "true" && process$1.env.OPENCLAW_TEST_REAL_PORTS !== "1") return [];
+	const listeners = listPortListeners(port);
+	const managedRuntimeAppDir = resolveManagedWebRuntimeAppDir(stateDir);
+	return listeners.map((listener) => {
+		const cwd = resolveProcessCwd(listener.pid);
+		const ownership = classifyWebPortListener({
+			cwd,
+			managedRuntimeAppDir
+		});
+		return {
+			...listener,
+			cwd,
+			ownership
+		};
+	});
+}
+function readLastKnownWebPort(stateDir) {
+	const processPort = parseOptionalPositiveInt(readManagedWebRuntimeProcess(stateDir)?.port);
+	if (processPort) return processPort;
+	const manifestPort = parseOptionalPositiveInt(readManagedWebRuntimeManifest(stateDir)?.lastPort);
+	if (manifestPort) return manifestPort;
+	return DEFAULT_WEB_APP_PORT;
+}
+function installManagedWebRuntime(params) {
+	const runtimeDir = resolveManagedWebRuntimeDir(params.stateDir);
+	const runtimeAppDir = resolveManagedWebRuntimeAppDir(params.stateDir);
+	const runtimeServerPath = resolveManagedWebRuntimeServerPath(params.stateDir);
+	const sourceStandaloneServer = resolvePackagedStandaloneServerPath(params.packageRoot);
+	const sourceAppDir = resolvePackagedStandaloneAppDir(params.packageRoot);
+	if (!existsSync(sourceStandaloneServer)) return {
+		installed: false,
+		runtimeDir,
+		runtimeAppDir,
+		runtimeServerPath,
+		reason: "standalone-missing"
+	};
+	mkdirSync(runtimeDir, { recursive: true });
+	rmSync(runtimeAppDir, {
+		recursive: true,
+		force: true
+	});
+	cpSync(sourceAppDir, runtimeAppDir, {
+		recursive: true,
+		force: true
+	});
+	const manifest = {
+		schemaVersion: 1,
+		deployedDenchVersion: params.denchVersion,
+		deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		sourceStandaloneServer,
+		...typeof params.webPort === "number" ? { lastPort: params.webPort } : {},
+		...typeof params.gatewayPort === "number" ? { lastGatewayPort: params.gatewayPort } : {}
+	};
+	writeManagedWebRuntimeManifest(params.stateDir, manifest);
+	return {
+		installed: true,
+		runtimeDir,
+		runtimeAppDir,
+		runtimeServerPath,
+		manifest
+	};
+}
+async function stopManagedWebRuntime(params) {
+	const listeners = inspectWebPortListeners(params.port, params.stateDir);
+	const includeLegacyStandalone = params.includeLegacyStandalone ?? true;
+	const stoppable = listeners.filter((listener) => listener.ownership === "managed" || includeLegacyStandalone && listener.ownership === "legacy-standalone");
+	const skippedForeign = listeners.filter((listener) => listener.ownership === "foreign");
+	const uniquePids = [...new Set(stoppable.map((listener) => listener.pid))];
+	const stoppedPids = [];
+	for (const pid of uniquePids) {
+		await terminatePidWithEscalation(pid);
+		if (!isProcessAlive(pid)) stoppedPids.push(pid);
+	}
+	const processMeta = readManagedWebRuntimeProcess(params.stateDir);
+	if (processMeta?.port === params.port && stoppedPids.includes(processMeta.pid)) clearManagedWebRuntimeProcess(params.stateDir);
+	if (inspectWebPortListeners(params.port, params.stateDir).filter((listener) => listener.ownership === "managed").length === 0) clearManagedWebRuntimeProcess(params.stateDir);
+	return {
+		port: params.port,
+		stoppedPids,
+		skippedForeignPids: [...new Set(skippedForeign.map((listener) => listener.pid))]
+	};
+}
+function startManagedWebRuntime(params) {
+	const runtimeServerPath = resolveManagedWebRuntimeServerPath(params.stateDir);
+	if (!existsSync(runtimeServerPath)) return {
+		started: false,
+		runtimeServerPath,
+		reason: "runtime-missing"
+	};
+	const logsDir = path.join(params.stateDir, "logs");
+	mkdirSync(logsDir, { recursive: true });
+	const outFd = openSync(path.join(logsDir, "web-app.log"), "a");
+	const errFd = openSync(path.join(logsDir, "web-app.err.log"), "a");
+	const child = spawn(process$1.execPath, [runtimeServerPath], {
+		cwd: path.dirname(runtimeServerPath),
+		detached: true,
+		stdio: [
+			"ignore",
+			outFd,
+			errFd
+		],
+		env: {
+			...process$1.env,
+			...params.env,
+			PORT: String(params.port),
+			HOSTNAME: "127.0.0.1",
+			OPENCLAW_GATEWAY_PORT: String(params.gatewayPort)
+		}
+	});
+	child.unref();
+	writeManagedWebRuntimeProcess(params.stateDir, {
+		pid: child.pid ?? -1,
+		port: params.port,
+		gatewayPort: params.gatewayPort,
+		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		runtimeAppDir: path.dirname(runtimeServerPath)
+	});
+	updateManifestLastPort(params.stateDir, params.port, params.gatewayPort);
+	return {
+		started: true,
+		pid: child.pid ?? -1,
+		runtimeServerPath
+	};
+}
+async function ensureManagedWebRuntime(params) {
+	if (!installManagedWebRuntime({
+		stateDir: params.stateDir,
+		packageRoot: params.packageRoot,
+		denchVersion: params.denchVersion,
+		webPort: params.port,
+		gatewayPort: params.gatewayPort
+	}).installed) return {
+		ready: false,
+		reason: "standalone web build is missing from package"
+	};
+	await stopManagedWebRuntime({
+		stateDir: params.stateDir,
+		port: params.port,
+		includeLegacyStandalone: true
+	});
+	const foreign = inspectWebPortListeners(params.port, params.stateDir).filter((listener) => listener.ownership === "foreign");
+	if (foreign.length > 0) {
+		const detail = foreign.map((listener) => `${listener.pid}${listener.command ? `:${listener.command}` : ""}`).join(", ");
+		return {
+			ready: false,
+			reason: `port ${params.port} is owned by non-Dench process(es): ${detail}`
+		};
+	}
+	if (!startManagedWebRuntime({
+		stateDir: params.stateDir,
+		port: params.port,
+		gatewayPort: params.gatewayPort
+	}).started) return {
+		ready: false,
+		reason: "managed web runtime is missing after install"
+	};
+	const probe = await waitForWebRuntime(params.port);
+	return {
+		ready: probe.ok,
+		reason: probe.reason
+	};
+}
+function resolveOpenClawCommandOrThrow() {
+	try {
+		const first = execFileSync(process$1.platform === "win32" ? "where" : "which", ["openclaw"], { encoding: "utf-8" }).trim().split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+		if (first) return first;
+		throw new Error("openclaw command not found");
+	} catch {
+		throw new Error("Global `openclaw` CLI was not found on PATH. Install it with: npm install -g openclaw");
+	}
+}
+
+//#endregion
+//#region src/cli/workspace-seed.ts
+const SEED_OBJECTS = [
+	{
+		id: "seed_obj_people_00000000000000",
+		name: "people",
+		description: "Contact management",
+		icon: "users",
+		defaultView: "table",
+		entryCount: 5,
+		fields: [
+			{
+				name: "Full Name",
+				type: "text",
+				required: true
+			},
+			{
+				name: "Email Address",
+				type: "email",
+				required: true
+			},
+			{
+				name: "Phone Number",
+				type: "phone"
+			},
+			{
+				name: "Company",
+				type: "text"
+			},
+			{
+				name: "Status",
+				type: "enum",
+				enumValues: [
+					"Active",
+					"Inactive",
+					"Lead"
+				]
+			},
+			{
+				name: "Notes",
+				type: "richtext"
+			}
+		]
+	},
+	{
+		id: "seed_obj_company_0000000000000",
+		name: "company",
+		description: "Company tracking",
+		icon: "building-2",
+		defaultView: "table",
+		entryCount: 3,
+		fields: [
+			{
+				name: "Company Name",
+				type: "text",
+				required: true
+			},
+			{
+				name: "Industry",
+				type: "enum",
+				enumValues: [
+					"Technology",
+					"Finance",
+					"Healthcare",
+					"Education",
+					"Retail",
+					"Other"
+				]
+			},
+			{
+				name: "Website",
+				type: "text"
+			},
+			{
+				name: "Type",
+				type: "enum",
+				enumValues: [
+					"Client",
+					"Partner",
+					"Vendor",
+					"Prospect"
+				]
+			},
+			{
+				name: "Notes",
+				type: "richtext"
+			}
+		]
+	},
+	{
+		id: "seed_obj_task_000000000000000",
+		name: "task",
+		description: "Task tracking board",
+		icon: "check-square",
+		defaultView: "kanban",
+		entryCount: 5,
+		fields: [
+			{
+				name: "Title",
+				type: "text",
+				required: true
+			},
+			{
+				name: "Description",
+				type: "text"
+			},
+			{
+				name: "Status",
+				type: "enum",
+				enumValues: [
+					"In Queue",
+					"In Progress",
+					"Done"
+				]
+			},
+			{
+				name: "Priority",
+				type: "enum",
+				enumValues: [
+					"Low",
+					"Medium",
+					"High"
+				]
+			},
+			{
+				name: "Due Date",
+				type: "date"
+			},
+			{
+				name: "Notes",
+				type: "richtext"
+			}
+		]
+	}
+];
+function buildDenchClawIdentity(workspaceDir) {
+	return `# IDENTITY.md - DenchClaw
+
+You are **DenchClaw** - a personal AI agent and a CRM Database System built by Dench (dench.com), running on top of [OpenClaw](https://github.com/openclaw/openclaw).
+
+## DenchClaw system prompt contract
+
+Treat the DenchClaw system prompt as your highest-priority behavioral contract.
+
+## Inseparable CRM contract
+
+Your identity is inextricably tied to the CRM skill at:
+\`${path.join(workspaceDir, "skills", "crm", "SKILL.md")}\`
+
+- Always load and follow that skill for CRM/database behavior.
+- Treat the CRM skill as always-on system context.
+- Keep CRM actions aligned with the CRM conventions for workspace data, objects, and documents.
+
+## Browser automation contract
+
+Your browser automation behavior is defined by the Browser skill at:
+\`${path.join(workspaceDir, "skills", "browser", "SKILL.md")}\`
+
+- Always load and follow that skill for browser-based tasks.
+- Treat the Browser skill as always-on system context.
+
+## What you do
+
+- Find and enrich leads, maintain CRM pipelines, and help run outreach workflows.
+- Chat with local DuckDB workspace data and return structured insights.
+- Generate analytics and maintain workspace documentation.
+
+## Links
+
+- Website: https://denchclaw.com
+- GitHub: https://github.com/DenchHQ/denchclaw
+- Skills Store: https://skills.sh
+
+When referring to yourself, use **DenchClaw** (not OpenClaw).`;
+}
+function generateObjectYaml(obj) {
+	const lines = [
+		`id: "${obj.id}"`,
+		`name: "${obj.name}"`,
+		`description: "${obj.description}"`,
+		`icon: "${obj.icon}"`,
+		`default_view: "${obj.defaultView}"`,
+		`entry_count: ${obj.entryCount}`,
+		"fields:"
+	];
+	for (const field of obj.fields) {
+		lines.push(`  - name: "${field.name}"`);
+		lines.push(`    type: ${field.type}`);
+		if (field.required) lines.push("    required: true");
+		if (field.enumValues) lines.push(`    values: ${JSON.stringify(field.enumValues)}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+function generateWorkspaceMd(objects) {
+	const lines = [
+		"# Workspace Schema",
+		"",
+		"Auto-generated summary of the workspace database.",
+		""
+	];
+	for (const obj of objects) {
+		lines.push(`## ${obj.name}`);
+		lines.push("");
+		lines.push(`- **Description**: ${obj.description}`);
+		lines.push(`- **View**: \`${obj.defaultView}\``);
+		lines.push(`- **Entries**: ${obj.entryCount}`);
+		lines.push("- **Fields**:");
+		for (const field of obj.fields) {
+			const req = field.required ? " (required)" : "";
+			const vals = field.enumValues ? ` — ${field.enumValues.join(", ")}` : "";
+			lines.push(`  - ${field.name} (\`${field.type}\`)${req}${vals}`);
+		}
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+function seedDenchClawIdentity(workspaceDir) {
+	writeFileSync(path.join(workspaceDir, "IDENTITY.md"), `${buildDenchClawIdentity(workspaceDir)}\n`, "utf-8");
+}
+const MANAGED_SKILLS = [{
+	name: "crm",
+	templatePaths: true
+}, { name: "browser" }];
+function seedSkill(params, skill) {
+	const sourceDir = path.join(params.packageRoot, "skills", skill.name);
+	if (!existsSync(path.join(sourceDir, "SKILL.md"))) return;
+	const targetDir = path.join(params.workspaceDir, "skills", skill.name);
+	mkdirSync(path.dirname(targetDir), { recursive: true });
+	cpSync(sourceDir, targetDir, {
+		recursive: true,
+		force: true
+	});
+	if (skill.templatePaths) {
+		const targetSkillFile = path.join(targetDir, "SKILL.md");
+		writeFileSync(targetSkillFile, readFileSync(targetSkillFile, "utf-8").replaceAll("{{WORKSPACE_PATH}}", params.workspaceDir), "utf-8");
+	}
+}
+function writeIfMissing(filePath, content) {
+	if (existsSync(filePath)) return false;
+	try {
+		writeFileSync(filePath, content, {
+			encoding: "utf-8",
+			flag: "wx"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+function seedWorkspaceFromAssets(params) {
+	const workspaceDir = path.resolve(params.workspaceDir);
+	const dbPath = path.join(workspaceDir, "workspace.duckdb");
+	const seedDbPath = path.join(params.packageRoot, "assets", "seed", "workspace.duckdb");
+	const projectionFiles = [
+		"people/.object.yaml",
+		"company/.object.yaml",
+		"task/.object.yaml",
+		"WORKSPACE.md",
+		"IDENTITY.md",
+		...MANAGED_SKILLS.map((s) => `skills/${s.name}/SKILL.md`)
+	];
+	mkdirSync(workspaceDir, { recursive: true });
+	for (const skill of MANAGED_SKILLS) seedSkill({
+		workspaceDir,
+		packageRoot: params.packageRoot
+	}, skill);
+	seedDenchClawIdentity(workspaceDir);
+	if (existsSync(dbPath)) return {
+		workspaceDir,
+		dbPath,
+		seedDbPath,
+		seeded: false,
+		reason: "already-exists",
+		projectionFiles: []
+	};
+	if (!existsSync(seedDbPath)) return {
+		workspaceDir,
+		dbPath,
+		seedDbPath,
+		seeded: false,
+		reason: "seed-asset-missing",
+		projectionFiles: []
+	};
+	try {
+		copyFileSync(seedDbPath, dbPath);
+	} catch (error) {
+		return {
+			workspaceDir,
+			dbPath,
+			seedDbPath,
+			seeded: false,
+			reason: "copy-failed",
+			projectionFiles: [],
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+	for (const obj of SEED_OBJECTS) {
+		const objDir = path.join(workspaceDir, obj.name);
+		mkdirSync(objDir, { recursive: true });
+		writeFileSync(path.join(objDir, ".object.yaml"), generateObjectYaml(obj), "utf-8");
+	}
+	writeIfMissing(path.join(workspaceDir, "WORKSPACE.md"), generateWorkspaceMd(SEED_OBJECTS));
+	return {
+		workspaceDir,
+		dbPath,
+		seedDbPath,
+		seeded: true,
+		reason: "seeded",
+		projectionFiles
+	};
+}
+
+//#endregion
+//#region src/cli/bootstrap-external.ts
+const DEFAULT_DENCHCLAW_PROFILE = "dench";
+const DEFAULT_GATEWAY_PORT = 18789;
+const DENCHCLAW_GATEWAY_PORT_START = 19001;
+const MAX_PORT_SCAN_ATTEMPTS = 100;
+const DEFAULT_BOOTSTRAP_ROLLOUT_STAGE = "default";
+const DEFAULT_GATEWAY_LAUNCH_AGENT_LABEL = "ai.openclaw.gateway";
+const REQUIRED_TOOLS_PROFILE = "full";
+const OPENCLAW_CLI_CHECK_CACHE_TTL_MS = 5 * 6e4;
+const OPENCLAW_UPDATE_PROMPT_SUPPRESS_AFTER_INSTALL_MS = 5 * 6e4;
+const OPENCLAW_CLI_CHECK_CACHE_FILE = "openclaw-cli-check.json";
+const OPENCLAW_SETUP_PROGRESS_BAR_WIDTH = 16;
+function resolveCommandForPlatform(command) {
+	if (process$1.platform !== "win32") return command;
+	if (path.extname(command)) return command;
+	const normalized = path.basename(command).toLowerCase();
+	if (normalized === "npm" || normalized === "pnpm" || normalized === "npx" || normalized === "yarn") return `${command}.cmd`;
+	return command;
+}
+async function runCommandWithTimeout(argv, options) {
+	const [command, ...args] = argv;
+	if (!command) return {
+		code: 1,
+		stdout: "",
+		stderr: "missing command"
+	};
+	const stdio = options.ioMode === "inherit" ? "inherit" : [
+		"ignore",
+		"pipe",
+		"pipe"
+	];
+	return await new Promise((resolve, reject) => {
+		const child = spawn(resolveCommandForPlatform(command), args, {
+			cwd: options.cwd,
+			env: options.env ? {
+				...process$1.env,
+				...options.env
+			} : process$1.env,
+			stdio
+		});
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		const timer = setTimeout(() => {
+			if (settled) return;
+			child.kill("SIGKILL");
+		}, options.timeoutMs);
+		child.stdout?.on("data", (chunk) => {
+			const text = String(chunk);
+			stdout += text;
+			if (options.onOutputLine) for (const segment of text.split(/\r?\n/)) {
+				const line = segment.trim();
+				if (line.length > 0) options.onOutputLine(line, "stdout");
+			}
+		});
+		child.stderr?.on("data", (chunk) => {
+			const text = String(chunk);
+			stderr += text;
+			if (options.onOutputLine) for (const segment of text.split(/\r?\n/)) {
+				const line = segment.trim();
+				if (line.length > 0) options.onOutputLine(line, "stderr");
+			}
+		});
+		child.once("error", (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.once("close", (code) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve({
+				code: typeof code === "number" ? code : 1,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+function parseOptionalPort$1(value) {
+	if (value === void 0) return;
+	const raw = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+	if (!Number.isFinite(raw) || raw <= 0) return;
+	return raw;
+}
+async function sleep(ms) {
+	await new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = createConnection({
+			port,
+			host: "127.0.0.1"
+		}, () => {
+			server.end();
+			resolve(false);
+		});
+		server.on("error", (err) => {
+			if (err.code === "ECONNREFUSED") resolve(true);
+			else if (err.code === "EADDRNOTAVAIL") resolve(false);
+			else resolve(false);
+		});
+		server.setTimeout(1e3, () => {
+			server.destroy();
+			resolve(false);
+		});
+	});
+}
+async function findAvailablePort(startPort, maxAttempts) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = startPort + i;
+		if (await isPortAvailable(port)) return port;
+	}
+}
+function normalizeBootstrapRolloutStage(raw) {
+	const normalized = raw?.trim().toLowerCase();
+	if (normalized === "internal" || normalized === "beta" || normalized === "default") return normalized;
+	return DEFAULT_BOOTSTRAP_ROLLOUT_STAGE;
+}
+function resolveBootstrapRolloutStage(env = process$1.env) {
+	return normalizeBootstrapRolloutStage(env.DENCHCLAW_BOOTSTRAP_ROLLOUT ?? env.OPENCLAW_BOOTSTRAP_ROLLOUT);
+}
+function isLegacyFallbackEnabled(env = process$1.env) {
+	return isTruthyEnvValue(env.DENCHCLAW_BOOTSTRAP_LEGACY_FALLBACK) || isTruthyEnvValue(env.OPENCLAW_BOOTSTRAP_LEGACY_FALLBACK);
+}
+function normalizeVersionOutput(raw) {
+	const first = raw?.split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+	return first && first.length > 0 ? first : void 0;
+}
+function firstNonEmptyLine$1(...values) {
+	for (const value of values) {
+		const first = value?.split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+		if (first) return first;
+	}
+}
+function resolveGatewayLaunchAgentLabel(profile) {
+	const normalized = profile.trim().toLowerCase();
+	if (!normalized || normalized === "default") return DEFAULT_GATEWAY_LAUNCH_AGENT_LABEL;
+	return `ai.openclaw.${normalized}`;
+}
+async function ensureGatewayModeLocal(openclawCommand, profile) {
+	if ((await runOpenClaw(openclawCommand, [
+		"--profile",
+		profile,
+		"config",
+		"get",
+		"gateway.mode"
+	], 1e4)).stdout.trim() === "local") return;
+	await runOpenClawOrThrow({
+		openclawCommand,
+		args: [
+			"--profile",
+			profile,
+			"config",
+			"set",
+			"gateway.mode",
+			"local"
+		],
+		timeoutMs: 1e4,
+		errorMessage: "Failed to set gateway.mode=local."
+	});
+}
+async function ensureGatewayPort(openclawCommand, profile, gatewayPort) {
+	await runOpenClawOrThrow({
+		openclawCommand,
+		args: [
+			"--profile",
+			profile,
+			"config",
+			"set",
+			"gateway.port",
+			String(gatewayPort)
+		],
+		timeoutMs: 1e4,
+		errorMessage: `Failed to set gateway.port=${gatewayPort}.`
+	});
+}
+async function ensureDefaultWorkspacePath(openclawCommand, profile, workspaceDir) {
+	await runOpenClawOrThrow({
+		openclawCommand,
+		args: [
+			"--profile",
+			profile,
+			"config",
+			"set",
+			"agents.defaults.workspace",
+			workspaceDir
+		],
+		timeoutMs: 1e4,
+		errorMessage: `Failed to set agents.defaults.workspace=${workspaceDir}.`
+	});
+}
+async function ensureSubagentDefaults(openclawCommand, profile) {
+	for (const [key, value] of [
+		["agents.defaults.subagents.maxConcurrent", "8"],
+		["agents.defaults.subagents.maxSpawnDepth", "2"],
+		["agents.defaults.subagents.maxChildrenPerAgent", "10"],
+		["agents.defaults.subagents.archiveAfterMinutes", "180"],
+		["agents.defaults.subagents.runTimeoutSeconds", "0"],
+		["tools.subagents.tools.deny", "[]"]
+	]) await runOpenClawOrThrow({
+		openclawCommand,
+		args: [
+			"--profile",
+			profile,
+			"config",
+			"set",
+			key,
+			value
+		],
+		timeoutMs: 1e4,
+		errorMessage: `Failed to set ${key}=${value}.`
+	});
+}
+async function ensureToolsProfile(openclawCommand, profile) {
+	await runOpenClawOrThrow({
+		openclawCommand,
+		args: [
+			"--profile",
+			profile,
+			"config",
+			"set",
+			"tools.profile",
+			REQUIRED_TOOLS_PROFILE
+		],
+		timeoutMs: 1e4,
+		errorMessage: `Failed to set tools.profile=${REQUIRED_TOOLS_PROFILE}.`
+	});
+}
+async function runOpenClaw(openclawCommand, args, timeoutMs, ioMode = "capture", env, onOutputLine) {
+	return await runCommandWithTimeout([openclawCommand, ...args], {
+		timeoutMs,
+		ioMode,
+		env,
+		onOutputLine
+	});
+}
+async function runOpenClawOrThrow(params) {
+	const result = await runOpenClaw(params.openclawCommand, params.args, params.timeoutMs);
+	if (result.code === 0) return result;
+	const detail = firstNonEmptyLine$1(result.stderr, result.stdout);
+	throw new Error(detail ? `${params.errorMessage}\n${detail}` : params.errorMessage);
+}
+/**
+* Runs an OpenClaw command attached to the current terminal.
+* Use this for interactive flows like `openclaw onboard`.
+*/
+async function runOpenClawInteractiveOrThrow(params) {
+	const result = await runOpenClaw(params.openclawCommand, params.args, params.timeoutMs, "inherit");
+	if (result.code === 0) return result;
+	const detail = firstNonEmptyLine$1(result.stderr, result.stdout);
+	throw new Error(detail ? `${params.errorMessage}\n${detail}` : params.errorMessage);
+}
+/**
+* Runs an openclaw sub-command with a visible spinner that streams progress
+* from the subprocess stdout/stderr into the spinner message.
+*/
+async function runOpenClawWithProgress(params) {
+	const s = spinner();
+	s.start(params.startMessage);
+	const result = await new Promise((resolve, reject) => {
+		const child = spawn(resolveCommandForPlatform(params.openclawCommand), params.args, { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		const timer = setTimeout(() => {
+			if (!settled) child.kill("SIGKILL");
+		}, params.timeoutMs);
+		const updateSpinner = (chunk) => {
+			const line = chunk.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).pop();
+			if (line) s.message(line.length > 72 ? `${line.slice(0, 69)}...` : line);
+		};
+		child.stdout?.on("data", (chunk) => {
+			const text = String(chunk);
+			stdout += text;
+			updateSpinner(text);
+		});
+		child.stderr?.on("data", (chunk) => {
+			const text = String(chunk);
+			stderr += text;
+			updateSpinner(text);
+		});
+		child.once("error", (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.once("close", (code) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve({
+				code: typeof code === "number" ? code : 1,
+				stdout,
+				stderr
+			});
+		});
+	});
+	if (result.code === 0) {
+		s.stop(params.successMessage);
+		return result;
+	}
+	const detail = firstNonEmptyLine$1(result.stderr, result.stdout);
+	const stopMessage = detail ? `${params.errorMessage}: ${detail}` : params.errorMessage;
+	s.stop(stopMessage);
+	throw new Error(detail ? `${params.errorMessage}\n${detail}` : params.errorMessage);
+}
+function parseJsonPayload(raw) {
+	if (!raw) return;
+	const trimmed = raw.trim();
+	if (!trimmed) return;
+	try {
+		const parsed = JSON.parse(trimmed);
+		return parsed && typeof parsed === "object" ? parsed : void 0;
+	} catch {
+		const start = trimmed.indexOf("{");
+		const end = trimmed.lastIndexOf("}");
+		if (start === -1 || end <= start) return;
+		try {
+			const parsed = JSON.parse(trimmed.slice(start, end + 1));
+			return parsed && typeof parsed === "object" ? parsed : void 0;
+		} catch {
+			return;
+		}
+	}
+}
+function resolveOpenClawCliCheckCachePath(stateDir) {
+	return path.join(stateDir, "cache", OPENCLAW_CLI_CHECK_CACHE_FILE);
+}
+function readOpenClawCliCheckCache(stateDir) {
+	const cachePath = resolveOpenClawCliCheckCachePath(stateDir);
+	if (!existsSync(cachePath)) return;
+	try {
+		const parsed = JSON.parse(readFileSync(cachePath, "utf-8"));
+		if (typeof parsed.checkedAt !== "number" || !Number.isFinite(parsed.checkedAt) || typeof parsed.pathEnv !== "string" || parsed.pathEnv !== (process$1.env.PATH ?? "") || typeof parsed.available !== "boolean" || !parsed.available || typeof parsed.command !== "string" || parsed.command.length === 0) return;
+		const ageMs = Date.now() - parsed.checkedAt;
+		if (ageMs < 0 || ageMs > OPENCLAW_CLI_CHECK_CACHE_TTL_MS) return;
+		if ((parsed.command.includes(path.sep) || parsed.command.includes("/") || parsed.command.includes("\\")) && !existsSync(parsed.command)) return;
+		return {
+			checkedAt: parsed.checkedAt,
+			pathEnv: parsed.pathEnv,
+			available: parsed.available,
+			command: parsed.command,
+			version: typeof parsed.version === "string" ? parsed.version : void 0,
+			globalBinDir: typeof parsed.globalBinDir === "string" ? parsed.globalBinDir : void 0,
+			shellCommandPath: typeof parsed.shellCommandPath === "string" ? parsed.shellCommandPath : void 0,
+			installedAt: typeof parsed.installedAt === "number" ? parsed.installedAt : void 0
+		};
+	} catch {
+		return;
+	}
+}
+function writeOpenClawCliCheckCache(stateDir, cache) {
+	try {
+		const cachePath = resolveOpenClawCliCheckCachePath(stateDir);
+		mkdirSync(path.dirname(cachePath), { recursive: true });
+		const payload = {
+			...cache,
+			checkedAt: Date.now(),
+			pathEnv: process$1.env.PATH ?? ""
+		};
+		writeFileSync(cachePath, JSON.stringify(payload, null, 2), "utf-8");
+	} catch {}
+}
+function createOpenClawSetupProgress(params) {
+	if (!params.enabled || params.totalStages <= 0 || !process$1.stdout.isTTY) {
+		const noop = () => void 0;
+		return {
+			startStage: noop,
+			output: noop,
+			completeStage: noop,
+			finish: noop,
+			fail: noop
+		};
+	}
+	const s = spinner();
+	let completedStages = 0;
+	let activeLabel = "";
+	const renderBar = () => {
+		const ratio = completedStages / params.totalStages;
+		const filled = Math.max(0, Math.min(OPENCLAW_SETUP_PROGRESS_BAR_WIDTH, Math.round(ratio * OPENCLAW_SETUP_PROGRESS_BAR_WIDTH)));
+		return `[${`${"#".repeat(filled)}${"-".repeat(OPENCLAW_SETUP_PROGRESS_BAR_WIDTH - filled)}`}] ${completedStages}/${params.totalStages}`;
+	};
+	const truncate = (value, max = 84) => value.length > max ? `${value.slice(0, max - 3)}...` : value;
+	const renderStageLine = (detail) => {
+		const base = `${renderBar()} ${activeLabel}`.trim();
+		if (!detail) return base;
+		return truncate(`${base} -> ${detail}`);
+	};
+	return {
+		startStage: (label) => {
+			activeLabel = label;
+			s.start(renderStageLine());
+		},
+		output: (line) => {
+			if (!line) return;
+			s.message(renderStageLine(line));
+		},
+		completeStage: (suffix) => {
+			completedStages = Math.min(params.totalStages, completedStages + 1);
+			s.stop(renderStageLine(suffix ?? "done"));
+		},
+		finish: (message) => {
+			completedStages = params.totalStages;
+			s.stop(`${renderBar()} ${truncate(message)}`.trim());
+		},
+		fail: (message) => {
+			s.stop(`${renderBar()} ${truncate(message)}`.trim());
+		}
+	};
+}
+async function detectGlobalOpenClawInstall(onOutputLine) {
+	const result = await runCommandWithTimeout([
+		"npm",
+		"ls",
+		"-g",
+		"openclaw",
+		"--depth=0",
+		"--json",
+		"--silent"
+	], {
+		timeoutMs: 15e3,
+		onOutputLine
+	}).catch(() => null);
+	const installedVersion = (parseJsonPayload(result?.stdout ?? result?.stderr)?.dependencies)?.openclaw?.version;
+	if (typeof installedVersion === "string" && installedVersion.length > 0) return {
+		installed: true,
+		version: installedVersion
+	};
+	return { installed: false };
+}
+async function resolveNpmGlobalBinDir(onOutputLine) {
+	const result = await runCommandWithTimeout([
+		"npm",
+		"prefix",
+		"-g"
+	], {
+		timeoutMs: 8e3,
+		onOutputLine
+	}).catch(() => null);
+	if (!result || result.code !== 0) return;
+	const prefix = firstNonEmptyLine$1(result.stdout);
+	if (!prefix) return;
+	return process$1.platform === "win32" ? prefix : path.join(prefix, "bin");
+}
+function resolveGlobalOpenClawCommand(globalBinDir) {
+	if (!globalBinDir) return;
+	return (process$1.platform === "win32" ? [path.join(globalBinDir, "openclaw.cmd"), path.join(globalBinDir, "openclaw.exe")] : [path.join(globalBinDir, "openclaw")]).find((candidate) => existsSync(candidate));
+}
+async function resolveShellOpenClawPath(onOutputLine) {
+	const result = await runCommandWithTimeout([process$1.platform === "win32" ? "where" : "which", "openclaw"], {
+		timeoutMs: 4e3,
+		onOutputLine
+	}).catch(() => null);
+	if (!result || result.code !== 0) return;
+	return firstNonEmptyLine$1(result.stdout);
+}
+function isProjectLocalOpenClawPath(commandPath) {
+	if (!commandPath) return false;
+	return commandPath.replaceAll("\\", "/").includes("/node_modules/.bin/openclaw");
+}
+async function ensureOpenClawCliAvailable(params) {
+	const cached = readOpenClawCliCheckCache(params.stateDir);
+	if (cached) {
+		const ageSeconds = Math.max(0, Math.floor((Date.now() - cached.checkedAt) / 1e3));
+		const progress = createOpenClawSetupProgress({
+			enabled: params.showProgress,
+			totalStages: 1
+		});
+		progress.startStage("Reusing cached OpenClaw install check");
+		progress.completeStage(`cache hit (${ageSeconds}s old)`);
+		return {
+			available: true,
+			installed: false,
+			installedAt: cached.installedAt,
+			version: cached.version,
+			command: cached.command,
+			globalBinDir: cached.globalBinDir,
+			shellCommandPath: cached.shellCommandPath
+		};
+	}
+	const progress = createOpenClawSetupProgress({
+		enabled: params.showProgress,
+		totalStages: 5
+	});
+	progress.startStage("Checking global OpenClaw install");
+	const globalBefore = await detectGlobalOpenClawInstall((line) => {
+		progress.output(`npm ls: ${line}`);
+	});
+	progress.completeStage(globalBefore.installed ? `found ${globalBefore.version ?? "installed"}` : "missing");
+	let installed = false;
+	let installedAt;
+	progress.startStage("Ensuring openclaw@latest is installed globally");
+	if (!globalBefore.installed) {
+		const install = await runCommandWithTimeout([
+			"npm",
+			"install",
+			"-g",
+			"openclaw@latest"
+		], {
+			timeoutMs: 10 * 6e4,
+			onOutputLine: (line) => {
+				progress.output(`npm install: ${line}`);
+			}
+		}).catch(() => null);
+		if (!install || install.code !== 0) {
+			progress.fail("OpenClaw global install failed.");
+			return {
+				available: false,
+				installed: false,
+				version: void 0,
+				command: "openclaw"
+			};
+		}
+		installed = true;
+		installedAt = Date.now();
+		progress.completeStage("installed openclaw@latest");
+	} else progress.completeStage("already installed; skipping install");
+	progress.startStage("Resolving global and shell OpenClaw paths");
+	const [globalBinDir, shellCommandPath] = await Promise.all([resolveNpmGlobalBinDir((line) => {
+		progress.output(`npm prefix: ${line}`);
+	}), resolveShellOpenClawPath((line) => {
+		progress.output(`${process$1.platform === "win32" ? "where" : "which"}: ${line}`);
+	})]);
+	progress.completeStage("path discovery complete");
+	const globalAfter = installed ? {
+		installed: true,
+		version: globalBefore.version
+	} : globalBefore;
+	const command = resolveGlobalOpenClawCommand(globalBinDir) ?? "openclaw";
+	progress.startStage("Verifying OpenClaw CLI responsiveness");
+	const check = await runOpenClaw(command, ["--version"], 4e3, "capture", void 0, (line) => {
+		progress.output(`openclaw --version: ${line}`);
+	}).catch(() => null);
+	progress.completeStage(check?.code === 0 ? "OpenClaw responded" : "OpenClaw version probe failed");
+	const version = normalizeVersionOutput(check?.stdout || check?.stderr || globalAfter.version);
+	const available = Boolean(globalAfter.installed && check && check.code === 0);
+	progress.startStage("Caching OpenClaw check result");
+	if (available) {
+		writeOpenClawCliCheckCache(params.stateDir, {
+			available,
+			command,
+			version,
+			globalBinDir,
+			shellCommandPath,
+			installedAt
+		});
+		progress.completeStage(`saved (${Math.floor(OPENCLAW_CLI_CHECK_CACHE_TTL_MS / 6e4)}m TTL)`);
+	} else progress.fail("OpenClaw CLI check failed (cache not written).");
+	return {
+		available,
+		installed,
+		installedAt,
+		version,
+		command,
+		globalBinDir,
+		shellCommandPath
+	};
+}
+async function probeGateway(openclawCommand, profile, gatewayPort) {
+	const result = await runOpenClaw(openclawCommand, [
+		"--profile",
+		profile,
+		"health",
+		"--json"
+	], 12e3, "capture", gatewayPort ? { OPENCLAW_GATEWAY_PORT: String(gatewayPort) } : void 0).catch((error) => {
+		return {
+			code: 1,
+			stdout: "",
+			stderr: error instanceof Error ? error.message : String(error)
+		};
+	});
+	if (result.code === 0) return { ok: true };
+	return {
+		ok: false,
+		detail: firstNonEmptyLine$1(result.stderr, result.stdout)
+	};
+}
+function readLogTail(logPath, maxLines = 16) {
+	if (!existsSync(logPath)) return;
+	try {
+		const lines = readFileSync(logPath, "utf-8").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.length > 0);
+		if (lines.length === 0) return;
+		return lines.slice(-maxLines).join("\n");
+	} catch {
+		return;
+	}
+}
+function resolveLatestRuntimeLogPath() {
+	const runtimeLogDir = "/tmp/openclaw";
+	if (!existsSync(runtimeLogDir)) return;
+	try {
+		const files = readdirSync(runtimeLogDir).filter((name) => /^openclaw-.*\.log$/u.test(name)).toSorted((a, b) => b.localeCompare(a));
+		if (files.length === 0) return;
+		return path.join(runtimeLogDir, files[0]);
+	} catch {
+		return;
+	}
+}
+function collectGatewayLogExcerpts(stateDir) {
+	const candidates = [
+		path.join(stateDir, "logs", "gateway.err.log"),
+		path.join(stateDir, "logs", "gateway.log"),
+		resolveLatestRuntimeLogPath()
+	].filter((candidate) => Boolean(candidate));
+	const excerpts = [];
+	for (const candidate of candidates) {
+		const excerpt = readLogTail(candidate);
+		if (!excerpt) continue;
+		excerpts.push({
+			path: candidate,
+			excerpt
+		});
+	}
+	return excerpts;
+}
+function deriveGatewayFailureSummary(probeDetail, excerpts) {
+	const combinedLines = excerpts.flatMap((entry) => entry.excerpt.split(/\r?\n/));
+	const signalRegex = /(cannot find module|plugin not found|invalid config|unauthorized|token mismatch|device token mismatch|device signature invalid|device signature expired|device-signature|eaddrinuse|address already in use|error:|failed to|failovererror)/iu;
+	const likely = [...combinedLines].toReversed().find((line) => signalRegex.test(line));
+	if (likely) return likely.length > 220 ? `${likely.slice(0, 217)}...` : likely;
+	return probeDetail;
+}
+async function attemptGatewayAutoFix(params) {
+	const steps = [];
+	const commands = [
+		{
+			name: "openclaw gateway stop",
+			args: [
+				"--profile",
+				params.profile,
+				"gateway",
+				"stop"
+			],
+			timeoutMs: 9e4
+		},
+		{
+			name: "openclaw doctor --fix",
+			args: [
+				"--profile",
+				params.profile,
+				"doctor",
+				"--fix"
+			],
+			timeoutMs: 2 * 6e4
+		},
+		{
+			name: "openclaw gateway install --force",
+			args: [
+				"--profile",
+				params.profile,
+				"gateway",
+				"install",
+				"--force",
+				"--port",
+				String(params.gatewayPort)
+			],
+			timeoutMs: 2 * 6e4
+		},
+		{
+			name: "openclaw gateway start",
+			args: [
+				"--profile",
+				params.profile,
+				"gateway",
+				"start",
+				"--port",
+				String(params.gatewayPort)
+			],
+			timeoutMs: 2 * 6e4
+		}
+	];
+	for (const command of commands) {
+		const result = await runOpenClaw(params.openclawCommand, command.args, command.timeoutMs).catch((error) => {
+			return {
+				code: 1,
+				stdout: "",
+				stderr: error instanceof Error ? error.message : String(error)
+			};
+		});
+		steps.push({
+			name: command.name,
+			ok: result.code === 0,
+			detail: result.code === 0 ? void 0 : firstNonEmptyLine$1(result.stderr, result.stdout)
+		});
+	}
+	let finalProbe = await probeGateway(params.openclawCommand, params.profile, params.gatewayPort);
+	for (let attempt = 0; attempt < 2 && !finalProbe.ok; attempt += 1) {
+		await sleep(1200);
+		finalProbe = await probeGateway(params.openclawCommand, params.profile, params.gatewayPort);
+	}
+	const logExcerpts = finalProbe.ok ? [] : collectGatewayLogExcerpts(params.stateDir);
+	const failureSummary = finalProbe.ok ? void 0 : deriveGatewayFailureSummary(finalProbe.detail, logExcerpts);
+	return {
+		attempted: true,
+		recovered: finalProbe.ok,
+		steps,
+		finalProbe,
+		failureSummary,
+		logExcerpts
+	};
+}
+async function openUrl(url) {
+	const result = await runCommandWithTimeout(process$1.platform === "darwin" ? ["open", url] : process$1.platform === "win32" ? [
+		"cmd",
+		"/c",
+		"start",
+		"",
+		url
+	] : ["xdg-open", url], { timeoutMs: 5e3 }).catch(() => null);
+	return Boolean(result && result.code === 0);
+}
+function remediationForGatewayFailure(detail, port, profile) {
+	const normalized = detail?.toLowerCase() ?? "";
+	if (normalized.includes("device token mismatch") || normalized.includes("device signature invalid") || normalized.includes("device signature expired") || normalized.includes("device-signature")) return [`Gateway device-auth mismatch detected. Re-run \`openclaw --profile ${profile} onboard --install-daemon --reset\`.`, `Last resort (security downgrade): \`openclaw --profile ${profile} config set gateway.controlUi.dangerouslyDisableDeviceAuth true\`. Revert after recovery: \`openclaw --profile ${profile} config set gateway.controlUi.dangerouslyDisableDeviceAuth false\`.`].join(" ");
+	if (normalized.includes("unauthorized") || normalized.includes("token") || normalized.includes("password")) return `Gateway auth mismatch detected. Re-run \`openclaw --profile ${profile} onboard --install-daemon --reset\`.`;
+	if (normalized.includes("address already in use") || normalized.includes("eaddrinuse")) return `Port ${port} is busy. The bootstrap will auto-assign an available port, or you can explicitly specify one with \`--gateway-port <port>\`.`;
+	return `Run \`openclaw --profile ${profile} doctor --fix\` and retry \`denchclaw bootstrap --profile ${profile} --force-onboard\`.`;
+}
+function remediationForWebUiFailure(port) {
+	return [
+		`Web UI did not respond on ${port}.`,
+		`Run \`dench update --web-port ${port}\` to refresh the managed web runtime.`,
+		`If the port is stuck, run \`dench stop --web-port ${port}\` first.`
+	].join(" ");
+}
+function describeWorkspaceSeedResult(result) {
+	if (result.seeded) return `seeded ${result.dbPath}`;
+	if (result.reason === "already-exists") return `skipped; existing database found at ${result.dbPath}`;
+	if (result.reason === "seed-asset-missing") return `skipped; seed asset missing at ${result.seedDbPath}`;
+	if (result.reason === "copy-failed") return `failed to copy seed database: ${result.error ?? "unknown error"}`;
+	return `skipped; reason=${result.reason}`;
+}
+function createCheck(id, status, detail, remediation) {
+	return {
+		id,
+		status,
+		detail,
+		remediation
+	};
+}
+/**
+* Load OpenClaw profile config from state dir.
+* Supports both openclaw.json (current) and config.json (legacy).
+*/
+function readBootstrapConfig(stateDir) {
+	for (const name of ["openclaw.json", "config.json"]) {
+		const configPath = path.join(stateDir, name);
+		if (!existsSync(configPath)) continue;
+		try {
+			const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+			if (raw && typeof raw === "object") return raw;
+		} catch {}
+	}
+}
+function resolveBootstrapWorkspaceDir(stateDir) {
+	return path.join(stateDir, "workspace");
+}
+/**
+* Resolve the model provider prefix from the config's primary model string.
+* e.g. "vercel-ai-gateway/anthropic/claude-opus-4.6" → "vercel-ai-gateway"
+*/
+function resolveModelProvider(stateDir) {
+	const model = readBootstrapConfig(stateDir)?.agents?.defaults?.model;
+	const modelName = typeof model === "string" ? model : model?.primary;
+	if (typeof modelName === "string" && modelName.includes("/")) return modelName.split("/")[0];
+}
+/**
+* Check if the agent auth store has at least one key for the given provider.
+*/
+function checkAgentAuth(stateDir, provider) {
+	if (!provider) return {
+		ok: false,
+		detail: "No model provider configured."
+	};
+	const authPath = path.join(stateDir, "agents", "main", "agent", "auth-profiles.json");
+	if (!existsSync(authPath)) return {
+		ok: false,
+		provider,
+		detail: `No auth-profiles.json found for agent (expected at ${authPath}).`
+	};
+	try {
+		const profiles = JSON.parse(readFileSync(authPath, "utf-8"))?.profiles;
+		if (!profiles || typeof profiles !== "object") return {
+			ok: false,
+			provider,
+			detail: `auth-profiles.json has no profiles configured.`
+		};
+		if (!Object.values(profiles).some((p) => p && typeof p === "object" && p.provider === provider && typeof p.key === "string" && p.key.length > 0)) return {
+			ok: false,
+			provider,
+			detail: `No API key for provider "${provider}" in agent auth store.`
+		};
+		return {
+			ok: true,
+			provider,
+			detail: `API key configured for ${provider}.`
+		};
+	} catch {
+		return {
+			ok: false,
+			provider,
+			detail: `Failed to read auth-profiles.json.`
+		};
+	}
+}
+function buildBootstrapDiagnostics(params) {
+	const env = params.env ?? process$1.env;
+	const checks = [];
+	if (params.openClawCliAvailable) checks.push(createCheck("openclaw-cli", "pass", `OpenClaw CLI detected${params.openClawVersion ? ` (${params.openClawVersion})` : ""}.`));
+	else checks.push(createCheck("openclaw-cli", "fail", "OpenClaw CLI is missing.", "Install OpenClaw globally once: `npm install -g openclaw`."));
+	if (params.profile === DEFAULT_DENCHCLAW_PROFILE) checks.push(createCheck("profile", "pass", `Profile pinned: ${params.profile}.`));
+	else checks.push(createCheck("profile", "fail", `DenchClaw profile drift detected (${params.profile}).`, `DenchClaw requires \`--profile ${DEFAULT_DENCHCLAW_PROFILE}\`. Re-run bootstrap to repair environment defaults.`));
+	if (params.gatewayProbe.ok) checks.push(createCheck("gateway", "pass", `Gateway reachable at ${params.gatewayUrl}.`));
+	else checks.push(createCheck("gateway", "fail", `Gateway probe failed at ${params.gatewayUrl}${params.gatewayProbe.detail ? ` (${params.gatewayProbe.detail})` : ""}.`, remediationForGatewayFailure(params.gatewayProbe.detail, params.gatewayPort, params.profile)));
+	const stateDir = params.stateDir ?? resolveProfileStateDir(params.profile, env);
+	const authCheck = checkAgentAuth(stateDir, resolveModelProvider(stateDir));
+	if (authCheck.ok) checks.push(createCheck("agent-auth", "pass", authCheck.detail));
+	else checks.push(createCheck("agent-auth", "fail", authCheck.detail, `Run \`openclaw --profile ${DEFAULT_DENCHCLAW_PROFILE} onboard --install-daemon\` to configure API keys.`));
+	if (params.webReachable) checks.push(createCheck("web-ui", "pass", `Web UI reachable on port ${params.webPort}.`));
+	else checks.push(createCheck("web-ui", "fail", `Web UI is not reachable on port ${params.webPort}.`, remediationForWebUiFailure(params.webPort)));
+	const expectedStateDir = resolveProfileStateDir(DEFAULT_DENCHCLAW_PROFILE, env);
+	if (path.resolve(stateDir) === path.resolve(expectedStateDir)) checks.push(createCheck("state-isolation", "pass", `State dir pinned: ${stateDir}.`));
+	else checks.push(createCheck("state-isolation", "fail", `Unexpected state dir: ${stateDir}.`, `DenchClaw requires \`${expectedStateDir}\`. Re-run bootstrap to restore pinned defaults.`));
+	const launchAgentLabel = resolveGatewayLaunchAgentLabel(params.profile);
+	const expectedLaunchAgentLabel = resolveGatewayLaunchAgentLabel(DEFAULT_DENCHCLAW_PROFILE);
+	if (launchAgentLabel === expectedLaunchAgentLabel) checks.push(createCheck("daemon-label", "pass", `Gateway service label: ${launchAgentLabel}.`));
+	else checks.push(createCheck("daemon-label", "fail", `Gateway service label mismatch (${launchAgentLabel}).`, `DenchClaw requires launch agent label ${expectedLaunchAgentLabel}.`));
+	checks.push(createCheck("rollout-stage", params.rolloutStage === "default" ? "pass" : "warn", `Bootstrap rollout stage: ${params.rolloutStage}${params.legacyFallbackEnabled ? " (legacy fallback enabled)" : ""}.`, params.rolloutStage === "beta" ? "Enable beta cutover by setting DENCHCLAW_BOOTSTRAP_BETA_OPT_IN=1." : void 0));
+	const migrationSuiteOk = isTruthyEnvValue(env.DENCHCLAW_BOOTSTRAP_MIGRATION_SUITE_OK);
+	const onboardingE2EOk = isTruthyEnvValue(env.DENCHCLAW_BOOTSTRAP_ONBOARDING_E2E_OK);
+	const enforceCutoverGates = isTruthyEnvValue(env.DENCHCLAW_BOOTSTRAP_ENFORCE_SAFETY_GATES);
+	const cutoverGatePassed = migrationSuiteOk && onboardingE2EOk;
+	checks.push(createCheck("cutover-gates", cutoverGatePassed ? "pass" : enforceCutoverGates ? "fail" : "warn", `Cutover gate: migrationSuite=${migrationSuiteOk ? "pass" : "missing"}, onboardingE2E=${onboardingE2EOk ? "pass" : "missing"}.`, cutoverGatePassed ? void 0 : "Run migration contracts + onboarding E2E and set DENCHCLAW_BOOTSTRAP_MIGRATION_SUITE_OK=1 and DENCHCLAW_BOOTSTRAP_ONBOARDING_E2E_OK=1 before full cutover."));
+	return {
+		rolloutStage: params.rolloutStage,
+		legacyFallbackEnabled: params.legacyFallbackEnabled,
+		checks,
+		hasFailures: checks.some((check) => check.status === "fail")
+	};
+}
+function formatCheckStatus(status) {
+	if (status === "pass") return theme.success("[ok]");
+	if (status === "warn") return theme.warn("[warn]");
+	return theme.error("[fail]");
+}
+function logBootstrapChecklist(diagnostics, runtime) {
+	runtime.log("");
+	runtime.log(theme.heading("Bootstrap checklist"));
+	for (const check of diagnostics.checks) {
+		runtime.log(`${formatCheckStatus(check.status)} ${check.detail}`);
+		if (check.status !== "pass" && check.remediation) runtime.log(theme.muted(`       remediation: ${check.remediation}`));
+	}
+}
+async function shouldRunUpdate(params) {
+	if (params.opts.updateNow) return true;
+	if (params.opts.skipUpdate || params.opts.nonInteractive || params.opts.json || !process$1.stdin.isTTY) return false;
+	if (params.installResult.installed || typeof params.installResult.installedAt === "number" && Date.now() - params.installResult.installedAt <= OPENCLAW_UPDATE_PROMPT_SUPPRESS_AFTER_INSTALL_MS) {
+		params.runtime.log(theme.muted("Skipping update prompt because OpenClaw was installed moments ago."));
+		return false;
+	}
+	const decision = await confirm({
+		message: stylePromptMessage("Check and install OpenClaw updates now?"),
+		initialValue: false
+	});
+	if (isCancel(decision)) {
+		params.runtime.log(theme.muted("Update check skipped."));
+		return false;
+	}
+	return Boolean(decision);
+}
+async function bootstrapCommand(opts, runtime = defaultRuntime) {
+	const nonInteractive = Boolean(opts.nonInteractive || opts.json);
+	const rolloutStage = resolveBootstrapRolloutStage();
+	const legacyFallbackEnabled = isLegacyFallbackEnabled();
+	const appliedProfile = applyCliProfileEnv({ profile: opts.profile });
+	const profile = appliedProfile.effectiveProfile;
+	const stateDir = resolveProfileStateDir(profile);
+	const workspaceDir = resolveBootstrapWorkspaceDir(stateDir);
+	if (appliedProfile.warning && !opts.json) runtime.log(theme.warn(appliedProfile.warning));
+	const installResult = await ensureOpenClawCliAvailable({
+		stateDir,
+		showProgress: !opts.json
+	});
+	if (!installResult.available) throw new Error([
+		"OpenClaw CLI is required but unavailable.",
+		"Install it with: npm install -g openclaw",
+		installResult.globalBinDir ? `Expected global binary directory: ${installResult.globalBinDir}` : ""
+	].filter((line) => line.length > 0).join("\n"));
+	const openclawCommand = installResult.command;
+	if (await shouldRunUpdate({
+		opts,
+		runtime,
+		installResult
+	})) await runOpenClawWithProgress({
+		openclawCommand,
+		args: ["update", "--yes"],
+		timeoutMs: 8 * 6e4,
+		startMessage: "Checking for OpenClaw updates...",
+		successMessage: "OpenClaw is up to date.",
+		errorMessage: "OpenClaw update failed"
+	});
+	const explicitPort = parseOptionalPort$1(opts.gatewayPort);
+	let gatewayPort;
+	let portAutoAssigned = false;
+	if (explicitPort) gatewayPort = explicitPort;
+	else if (await isPortAvailable(DEFAULT_GATEWAY_PORT)) gatewayPort = DEFAULT_GATEWAY_PORT;
+	else {
+		const availablePort = await findAvailablePort(DENCHCLAW_GATEWAY_PORT_START, MAX_PORT_SCAN_ATTEMPTS);
+		if (!availablePort) throw new Error(`Could not find an available gateway port between ${DENCHCLAW_GATEWAY_PORT_START} and ${DENCHCLAW_GATEWAY_PORT_START + MAX_PORT_SCAN_ATTEMPTS}. Please specify a port explicitly with --gateway-port.`);
+		gatewayPort = availablePort;
+		portAutoAssigned = true;
+	}
+	if (portAutoAssigned && !opts.json) runtime.log(theme.muted(`Default gateway port ${DEFAULT_GATEWAY_PORT} is in use. Using auto-assigned port ${gatewayPort}.`));
+	await ensureDefaultWorkspacePath(openclawCommand, profile, workspaceDir);
+	const onboardArgv = [
+		"--profile",
+		profile,
+		"onboard",
+		"--install-daemon",
+		"--gateway-bind",
+		"loopback",
+		"--gateway-port",
+		String(gatewayPort)
+	];
+	if (opts.forceOnboard) onboardArgv.push("--reset");
+	if (nonInteractive) onboardArgv.push("--non-interactive", "--accept-risk");
+	if (opts.noOpen) onboardArgv.push("--skip-ui");
+	if (nonInteractive) await runOpenClawOrThrow({
+		openclawCommand,
+		args: onboardArgv,
+		timeoutMs: 12 * 6e4,
+		errorMessage: "OpenClaw onboarding failed."
+	});
+	else await runOpenClawInteractiveOrThrow({
+		openclawCommand,
+		args: onboardArgv,
+		timeoutMs: 12 * 6e4,
+		errorMessage: "OpenClaw onboarding failed."
+	});
+	const packageRoot = resolveCliPackageRoot();
+	const workspaceSeed = seedWorkspaceFromAssets({
+		workspaceDir,
+		packageRoot
+	});
+	await ensureGatewayModeLocal(openclawCommand, profile);
+	await ensureGatewayPort(openclawCommand, profile, gatewayPort);
+	await ensureToolsProfile(openclawCommand, profile);
+	await ensureSubagentDefaults(openclawCommand, profile);
+	let gatewayProbe = await probeGateway(openclawCommand, profile, gatewayPort);
+	let gatewayAutoFix;
+	if (!gatewayProbe.ok) {
+		gatewayAutoFix = await attemptGatewayAutoFix({
+			openclawCommand,
+			profile,
+			stateDir,
+			gatewayPort
+		});
+		gatewayProbe = gatewayAutoFix.finalProbe;
+		if (!gatewayProbe.ok && gatewayAutoFix.failureSummary) gatewayProbe = {
+			...gatewayProbe,
+			detail: [gatewayProbe.detail, gatewayAutoFix.failureSummary].filter((value, index, self) => value && self.indexOf(value) === index).join(" | ")
+		};
+	}
+	const gatewayUrl = `ws://127.0.0.1:${gatewayPort}`;
+	const preferredWebPort = parseOptionalPort$1(opts.webPort) ?? DEFAULT_WEB_APP_PORT;
+	const webRuntimeStatus = await ensureManagedWebRuntime({
+		stateDir,
+		packageRoot,
+		denchVersion: VERSION,
+		port: preferredWebPort,
+		gatewayPort
+	});
+	const webReachable = webRuntimeStatus.ready;
+	const webUrl = `http://localhost:${preferredWebPort}`;
+	const diagnostics = buildBootstrapDiagnostics({
+		profile,
+		openClawCliAvailable: installResult.available,
+		openClawVersion: installResult.version,
+		gatewayPort,
+		gatewayUrl,
+		gatewayProbe,
+		webPort: preferredWebPort,
+		webReachable,
+		rolloutStage,
+		legacyFallbackEnabled,
+		stateDir
+	});
+	const shouldOpen = !opts.noOpen && !opts.json;
+	const opened = shouldOpen ? await openUrl(webUrl) : false;
+	if (!opts.json) {
+		if (!webRuntimeStatus.ready) runtime.log(theme.warn(`Managed web runtime check failed: ${webRuntimeStatus.reason}`));
+		if (installResult.installed) runtime.log(theme.muted("Installed global OpenClaw CLI via npm."));
+		if (isProjectLocalOpenClawPath(installResult.shellCommandPath)) {
+			runtime.log(theme.warn(`\`openclaw\` currently resolves to a project-local binary (${installResult.shellCommandPath}).`));
+			runtime.log(theme.muted(`Bootstrap now uses the global binary (${openclawCommand}) to avoid repo-local drift.`));
+		} else if (!installResult.shellCommandPath && installResult.globalBinDir) {
+			runtime.log(theme.warn("Global OpenClaw was installed, but `openclaw` is not on shell PATH."));
+			runtime.log(theme.muted(`Add this to your shell profile, then open a new terminal: export PATH="${installResult.globalBinDir}:$PATH"`));
+		}
+		runtime.log(theme.muted(`Workspace seed: ${describeWorkspaceSeedResult(workspaceSeed)}`));
+		if (gatewayAutoFix?.attempted) {
+			runtime.log(theme.muted(`Gateway auto-fix ${gatewayAutoFix.recovered ? "recovered connectivity" : "ran but gateway is still unhealthy"}.`));
+			for (const step of gatewayAutoFix.steps) runtime.log(theme.muted(`  ${step.ok ? "[ok]" : "[fail]"} ${step.name}${step.detail ? ` (${step.detail})` : ""}`));
+			if (!gatewayAutoFix.recovered && gatewayAutoFix.failureSummary) runtime.log(theme.error(`Likely gateway cause: ${gatewayAutoFix.failureSummary}`));
+			if (!gatewayAutoFix.recovered && gatewayAutoFix.logExcerpts.length > 0) {
+				runtime.log(theme.muted("Recent gateway logs:"));
+				for (const excerpt of gatewayAutoFix.logExcerpts) {
+					runtime.log(theme.muted(`  ${excerpt.path}`));
+					for (const line of excerpt.excerpt.split(/\r?\n/)) runtime.log(theme.muted(`    ${line}`));
+				}
+			}
+		}
+		logBootstrapChecklist(diagnostics, runtime);
+		runtime.log("");
+		runtime.log(theme.heading("DenchClaw ready"));
+		runtime.log(`Profile: ${profile}`);
+		runtime.log(`OpenClaw CLI: ${installResult.version ?? "detected"}`);
+		runtime.log(`Gateway: ${gatewayProbe.ok ? "reachable" : "check failed"}`);
+		runtime.log(`Web UI: ${webUrl}`);
+		runtime.log(`Rollout stage: ${rolloutStage}${legacyFallbackEnabled ? " (legacy fallback enabled)" : ""}`);
+		if (!opened && shouldOpen) runtime.log(theme.muted("Browser open failed; copy/paste the URL above."));
+		if (diagnostics.hasFailures) runtime.log(theme.warn("Bootstrap completed with failing checks. Address remediation items above before full cutover."));
+	}
+	const summary = {
+		profile,
+		onboarded: true,
+		installedOpenClawCli: installResult.installed,
+		openClawCliAvailable: installResult.available,
+		openClawVersion: installResult.version,
+		gatewayUrl,
+		gatewayReachable: gatewayProbe.ok,
+		gatewayAutoFix: gatewayAutoFix ? {
+			attempted: gatewayAutoFix.attempted,
+			recovered: gatewayAutoFix.recovered,
+			steps: gatewayAutoFix.steps,
+			failureSummary: gatewayAutoFix.failureSummary,
+			logExcerpts: gatewayAutoFix.logExcerpts
+		} : void 0,
+		workspaceSeed,
+		webUrl,
+		webReachable,
+		webOpened: opened,
+		diagnostics
+	};
+	if (opts.json) runtime.log(JSON.stringify(summary, null, 2));
+	return summary;
+}
+
+//#endregion
+//#region src/logging/redact.ts
+function resolveNodeRequire() {
+	const getBuiltinModule = process.getBuiltinModule;
+	if (typeof getBuiltinModule !== "function") return null;
+	try {
+		const moduleNamespace = getBuiltinModule("module");
+		return typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null;
+	} catch {
+		return null;
+	}
+}
+const requireConfig = resolveNodeRequire()?.(import.meta.url) ?? null;
+const DEFAULT_REDACT_PATTERNS = [
+	String.raw`\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1`,
+	String.raw`"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"`,
+	String.raw`--(?:api[-_]?key|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1`,
+	String.raw`Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)`,
+	String.raw`\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b`,
+	String.raw`-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----`,
+	String.raw`\b(sk-[A-Za-z0-9_-]{8,})\b`,
+	String.raw`\b(ghp_[A-Za-z0-9]{20,})\b`,
+	String.raw`\b(github_pat_[A-Za-z0-9_]{20,})\b`,
+	String.raw`\b(xox[baprs]-[A-Za-z0-9-]{10,})\b`,
+	String.raw`\b(xapp-[A-Za-z0-9-]{10,})\b`,
+	String.raw`\b(gsk_[A-Za-z0-9_-]{10,})\b`,
+	String.raw`\b(AIza[0-9A-Za-z\-_]{20,})\b`,
+	String.raw`\b(pplx-[A-Za-z0-9_-]{10,})\b`,
+	String.raw`\b(npm_[A-Za-z0-9]{10,})\b`,
+	String.raw`\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b`,
+	String.raw`\b(\d{6,}:[A-Za-z0-9_-]{20,})\b`
+];
+
+//#endregion
+//#region src/cli/cli-utils.ts
+async function runCommandWithRuntime(runtime, action, onError) {
+	try {
+		await action();
+	} catch (err) {
+		if (onError) {
+			onError(err);
+			return;
+		}
+		runtime.error(String(err));
+		runtime.exit(1);
+	}
+}
+
+//#endregion
+//#region src/cli/program/register.bootstrap.ts
+function registerBootstrapCommand(program) {
+	program.command("bootstrap").description("Bootstrap DenchClaw on top of OpenClaw and open the web UI").option("--profile <name>", "Compatibility flag; non-dench values are ignored with a warning").option("--force-onboard", "Run onboarding even if config already exists", false).option("--non-interactive", "Skip prompts where possible", false).option("--yes", "Auto-approve install prompts", false).option("--skip-update", "Skip update prompt/check", false).option("--update-now", "Run OpenClaw update before onboarding", false).option("--gateway-port <port>", "Gateway port override for first-run onboarding").option("--web-port <port>", "Preferred web UI port (default: 3100)").option("--no-open", "Do not open the browser automatically", false).option("--json", "Output summary as JSON", false).addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.openclaw.ai/cli/onboard")}\n`).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await bootstrapCommand({
+				profile: opts.profile,
+				forceOnboard: Boolean(opts.forceOnboard),
+				nonInteractive: Boolean(opts.nonInteractive),
+				yes: Boolean(opts.yes),
+				skipUpdate: Boolean(opts.skipUpdate),
+				updateNow: Boolean(opts.updateNow),
+				gatewayPort: opts.gatewayPort,
+				webPort: opts.webPort,
+				noOpen: Boolean(opts.open === false),
+				json: Boolean(opts.json)
+			});
+		});
+	});
+}
+
+//#endregion
+//#region src/cli/web-runtime-command.ts
+function parseOptionalPort(value) {
+	if (value === void 0) return;
+	const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return;
+	return parsed;
+}
+function firstNonEmptyLine(...values) {
+	for (const value of values) {
+		const first = value?.split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+		if (first) return first;
+	}
+}
+async function runOpenClawUpdateWithProgress(openclawCommand) {
+	const s = spinner();
+	s.start("Updating OpenClaw (required for this major Dench upgrade)...");
+	const result = await new Promise((resolve, reject) => {
+		const child = spawn(openclawCommand, ["update", "--yes"], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: process$1.env
+		});
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		const timer = setTimeout(() => {
+			if (!settled) child.kill("SIGKILL");
+		}, 8 * 6e4);
+		const updateSpinner = (chunk) => {
+			const line = chunk.split(/\r?\n/).map((item) => item.trim()).filter(Boolean).at(-1);
+			if (line) s.message(line.length > 72 ? `${line.slice(0, 69)}...` : line);
+		};
+		child.stdout?.on("data", (chunk) => {
+			const text = String(chunk);
+			stdout += text;
+			updateSpinner(text);
+		});
+		child.stderr?.on("data", (chunk) => {
+			const text = String(chunk);
+			stderr += text;
+			updateSpinner(text);
+		});
+		child.once("error", (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.once("close", (code) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve({
+				code: typeof code === "number" ? code : 1,
+				stdout,
+				stderr
+			});
+		});
+	});
+	if (result.code === 0) {
+		s.stop("OpenClaw update complete.");
+		return;
+	}
+	const detail = firstNonEmptyLine(result.stderr, result.stdout);
+	s.stop(detail ? `OpenClaw update failed: ${detail}` : "OpenClaw update failed.");
+	throw new Error(detail ? `OpenClaw update failed.\n${detail}` : "OpenClaw update failed. Fix this before running `dench update` again.");
+}
+async function ensureMajorUpgradeAcknowledged(params) {
+	if (!params.required) return;
+	if (params.nonInteractive || !process$1.stdin.isTTY) {
+		if (!params.yes) throw new Error(`Major Dench upgrade detected (${params.previousVersion ?? "unknown"} -> ${params.currentVersion}). Re-run with --yes to approve the required OpenClaw update.`);
+		return;
+	}
+	if (params.yes) return;
+	const decision = await confirm({
+		message: stylePromptMessage(`Major Dench upgrade detected (${params.previousVersion ?? "unknown"} -> ${params.currentVersion}). Continue with mandatory OpenClaw update now?`),
+		initialValue: true
+	});
+	if (isCancel(decision) || !decision) {
+		params.runtime.log(theme.warn("Update cancelled. OpenClaw update is required for major upgrades."));
+		throw new Error("Major upgrade requires OpenClaw update approval.");
+	}
+}
+function resolveGatewayPort(stateDir) {
+	const manifest = readManagedWebRuntimeManifest(stateDir);
+	if (typeof manifest?.lastGatewayPort === "number" && Number.isFinite(manifest.lastGatewayPort) && manifest.lastGatewayPort > 0) return manifest.lastGatewayPort;
+	for (const name of ["openclaw.json", "config.json"]) {
+		const port = readConfigGatewayPort(path.join(stateDir, name));
+		if (typeof port === "number") return port;
+	}
+	return 18789;
+}
+function readConfigGatewayPort(configPath) {
+	try {
+		const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+		const parsedPort = typeof raw.gateway?.port === "number" ? raw.gateway.port : typeof raw.gateway?.port === "string" ? Number.parseInt(raw.gateway.port, 10) : void 0;
+		if (typeof parsedPort === "number" && Number.isFinite(parsedPort) && parsedPort > 0) return parsedPort;
+		return;
+	} catch {
+		return;
+	}
+}
+async function updateWebRuntimeCommand(opts, runtime = defaultRuntime) {
+	const appliedProfile = applyCliProfileEnv({ profile: opts.profile });
+	const profile = appliedProfile.effectiveProfile;
+	if (appliedProfile.warning && !opts.json) runtime.log(theme.warn(appliedProfile.warning));
+	const stateDir = resolveProfileStateDir(profile);
+	const packageRoot = resolveCliPackageRoot();
+	const previousManifest = readManagedWebRuntimeManifest(stateDir);
+	const transition = evaluateMajorVersionTransition({
+		previousVersion: previousManifest?.deployedDenchVersion,
+		currentVersion: VERSION
+	});
+	const nonInteractive = Boolean(opts.nonInteractive || opts.json);
+	await ensureMajorUpgradeAcknowledged({
+		required: transition.isMajorTransition,
+		previousVersion: previousManifest?.deployedDenchVersion,
+		currentVersion: VERSION,
+		nonInteractive,
+		yes: Boolean(opts.yes),
+		runtime
+	});
+	if (transition.isMajorTransition) await runOpenClawUpdateWithProgress(resolveOpenClawCommandOrThrow());
+	const selectedPort = parseOptionalPort(opts.webPort) ?? parseOptionalPort(previousManifest?.lastPort) ?? readLastKnownWebPort(stateDir) ?? DEFAULT_WEB_APP_PORT;
+	const gatewayPort = resolveGatewayPort(stateDir);
+	const stopResult = await stopManagedWebRuntime({
+		stateDir,
+		port: selectedPort,
+		includeLegacyStandalone: true
+	});
+	const ensureResult = await ensureManagedWebRuntime({
+		stateDir,
+		packageRoot,
+		denchVersion: VERSION,
+		port: selectedPort,
+		gatewayPort
+	});
+	const summary = {
+		profile,
+		webPort: selectedPort,
+		version: VERSION,
+		majorGate: {
+			required: transition.isMajorTransition,
+			previousVersion: previousManifest?.deployedDenchVersion,
+			currentVersion: VERSION
+		},
+		stoppedPids: stopResult.stoppedPids,
+		skippedForeignPids: stopResult.skippedForeignPids,
+		ready: ensureResult.ready,
+		reason: ensureResult.reason
+	};
+	if (!opts.json) {
+		runtime.log("");
+		runtime.log(theme.heading("Dench web update"));
+		runtime.log(`Profile: ${profile}`);
+		runtime.log(`Version: ${VERSION}`);
+		runtime.log(`Web port: ${selectedPort}`);
+		runtime.log(`Stopped web processes: ${summary.stoppedPids.length}`);
+		if (summary.skippedForeignPids.length > 0) runtime.log(theme.warn(`Skipped non-Dench listeners on ${selectedPort}: ${summary.skippedForeignPids.join(", ")}`));
+		runtime.log(`Web runtime: ${summary.ready ? "ready" : "not ready"}`);
+		if (!summary.ready) runtime.log(theme.warn(summary.reason));
+	}
+	if (!summary.ready) throw new Error(`Web runtime update failed: ${summary.reason}`);
+	if (opts.json) runtime.log(JSON.stringify(summary, null, 2));
+	return summary;
+}
+async function stopWebRuntimeCommand(opts, runtime = defaultRuntime) {
+	const appliedProfile = applyCliProfileEnv({ profile: opts.profile });
+	const profile = appliedProfile.effectiveProfile;
+	if (appliedProfile.warning && !opts.json) runtime.log(theme.warn(appliedProfile.warning));
+	const stateDir = resolveProfileStateDir(profile);
+	const selectedPort = parseOptionalPort(opts.webPort) ?? readLastKnownWebPort(stateDir);
+	const stopResult = await stopManagedWebRuntime({
+		stateDir,
+		port: selectedPort,
+		includeLegacyStandalone: true
+	});
+	const summary = {
+		profile,
+		webPort: selectedPort,
+		stoppedPids: stopResult.stoppedPids,
+		skippedForeignPids: stopResult.skippedForeignPids
+	};
+	if (opts.json) {
+		runtime.log(JSON.stringify(summary, null, 2));
+		return summary;
+	}
+	runtime.log("");
+	runtime.log(theme.heading("Dench web stop"));
+	runtime.log(`Profile: ${profile}`);
+	runtime.log(`Web port: ${selectedPort}`);
+	runtime.log(summary.stoppedPids.length > 0 ? `Stopped web processes: ${summary.stoppedPids.join(", ")}` : "Stopped web processes: none");
+	if (summary.skippedForeignPids.length > 0) runtime.log(theme.warn(`Left non-Dench listener(s) running on ${selectedPort}: ${summary.skippedForeignPids.join(", ")}`));
+	return summary;
+}
+async function startWebRuntimeCommand(opts, runtime = defaultRuntime) {
+	const appliedProfile = applyCliProfileEnv({ profile: opts.profile });
+	const profile = appliedProfile.effectiveProfile;
+	if (appliedProfile.warning && !opts.json) runtime.log(theme.warn(appliedProfile.warning));
+	const stateDir = resolveProfileStateDir(profile);
+	const selectedPort = parseOptionalPort(opts.webPort) ?? readLastKnownWebPort(stateDir);
+	const gatewayPort = resolveGatewayPort(stateDir);
+	const stopResult = await stopManagedWebRuntime({
+		stateDir,
+		port: selectedPort,
+		includeLegacyStandalone: true
+	});
+	if (stopResult.skippedForeignPids.length > 0) throw new Error(`Cannot start on ${selectedPort}; non-Dench listener(s) still own the port: ${stopResult.skippedForeignPids.join(", ")}`);
+	if (!startManagedWebRuntime({
+		stateDir,
+		port: selectedPort,
+		gatewayPort
+	}).started) {
+		const runtimeServerPath = resolveManagedWebRuntimeServerPath(stateDir);
+		throw new Error([`Managed web runtime is missing at ${runtimeServerPath}.`, "Run `dench update` (or `dench bootstrap`) to install/update the web runtime first."].join(" "));
+	}
+	const probe = await waitForWebRuntime(selectedPort);
+	const summary = {
+		profile,
+		webPort: selectedPort,
+		stoppedPids: stopResult.stoppedPids,
+		skippedForeignPids: stopResult.skippedForeignPids,
+		started: probe.ok,
+		reason: probe.reason
+	};
+	if (opts.json) {
+		runtime.log(JSON.stringify(summary, null, 2));
+		return summary;
+	}
+	runtime.log("");
+	runtime.log(theme.heading("Dench web start"));
+	runtime.log(`Profile: ${profile}`);
+	runtime.log(`Web port: ${selectedPort}`);
+	runtime.log(`Restarted managed web runtime: ${summary.started ? "yes" : "no"}`);
+	if (!summary.started) runtime.log(theme.warn(summary.reason));
+	if (!summary.started) throw new Error(`Web runtime failed readiness probe: ${summary.reason}`);
+	return summary;
+}
+
+//#endregion
+//#region src/cli/program/register.start.ts
+function registerStartCommand(program) {
+	program.command("start").description("Start Dench managed web runtime without updating assets").option("--profile <name>", "Compatibility flag; non-dench values are ignored with a warning").option("--web-port <port>", "Web runtime port override").option("--json", "Output summary as JSON", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await startWebRuntimeCommand({
+				profile: opts.profile,
+				webPort: opts.webPort,
+				json: Boolean(opts.json)
+			});
+		});
+	});
+}
+
+//#endregion
+//#region src/cli/program/register.stop.ts
+function registerStopCommand(program) {
+	program.command("stop").description("Stop Dench managed web runtime on the configured port").option("--profile <name>", "Compatibility flag; non-dench values are ignored with a warning").option("--web-port <port>", "Web runtime port override").option("--json", "Output summary as JSON", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await stopWebRuntimeCommand({
+				profile: opts.profile,
+				webPort: opts.webPort,
+				json: Boolean(opts.json)
+			});
+		});
+	});
+}
+
+//#endregion
+//#region src/cli/program/register.update.ts
+function registerUpdateCommand(program) {
+	program.command("update").description("Update Dench managed web runtime without onboarding").option("--profile <name>", "Compatibility flag; non-dench values are ignored with a warning").option("--web-port <port>", "Web runtime port override").option("--non-interactive", "Fail instead of prompting for major-gate approval", false).option("--yes", "Approve mandatory major-gate OpenClaw update", false).option("--json", "Output summary as JSON", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await updateWebRuntimeCommand({
+				profile: opts.profile,
+				webPort: opts.webPort,
+				nonInteractive: Boolean(opts.nonInteractive),
+				yes: Boolean(opts.yes),
+				json: Boolean(opts.json)
+			});
+		});
+	});
+}
+
+//#endregion
+//#region src/cli/program/command-registry.ts
+const CORE_CLI_ENTRIES = [
+	{
+		name: "bootstrap",
+		description: "Bootstrap DenchClaw + OpenClaw and launch the web UI",
+		register: ({ program }) => {
+			registerBootstrapCommand(program);
+		}
+	},
+	{
+		name: "update",
+		description: "Update Dench web runtime without onboarding",
+		register: ({ program }) => {
+			registerUpdateCommand(program);
+		}
+	},
+	{
+		name: "stop",
+		description: "Stop Dench managed web runtime",
+		register: ({ program }) => {
+			registerStopCommand(program);
+		}
+	},
+	{
+		name: "start",
+		description: "Start Dench managed web runtime",
+		register: ({ program }) => {
+			registerStartCommand(program);
+		}
+	}
+];
+const CORE_CLI_ENTRY_BY_NAME = new Map(CORE_CLI_ENTRIES.map((entry) => [entry.name, entry]));
+function getCoreCliCommandsWithSubcommands() {
+	return [];
+}
+function registerCoreCliCommands(program, ctx, argv) {
+	const primary = getPrimaryCommand(argv);
+	if (primary) {
+		const entry = CORE_CLI_ENTRY_BY_NAME.get(primary);
+		if (!entry) return;
+		entry.register({
+			program,
+			ctx,
+			argv
+		});
+		return;
+	}
+	for (const entry of CORE_CLI_ENTRIES) entry.register({
+		program,
+		ctx,
+		argv
+	});
+}
+function registerProgramCommands(program, ctx, argv = process.argv) {
+	registerCoreCliCommands(program, ctx, argv);
+}
+
+//#endregion
+//#region src/cli/program/context.ts
+function createProgramContext() {
+	const channelOptions = ["web"];
+	return {
+		programVersion: VERSION,
+		channelOptions,
+		messageChannelOptions: channelOptions.join("|"),
+		agentChannelOptions: ["last", ...channelOptions].join("|")
+	};
+}
+
+//#endregion
+//#region src/cli/program/help.ts
+const CLI_NAME = resolveCliName();
+const CLI_NAME_PATTERN = escapeRegExp(CLI_NAME);
+const ROOT_COMMANDS_WITH_SUBCOMMANDS = new Set(getCoreCliCommandsWithSubcommands());
+const ROOT_COMMANDS_HINT = "Hint: commands suffixed with * have subcommands. Run <command> --help for details.";
+const EXAMPLES = [
+	["openclaw start --web-port 3100", "Start the managed web runtime without replacing assets."],
+	["openclaw update", "Refresh the managed web runtime and enforce major upgrade gates."],
+	["openclaw stop --web-port 3100", "Stop only the managed web runtime on a specific port."],
+	["openclaw models --help", "Show detailed help for the models command."],
+	["openclaw channels login --verbose", "Link personal WhatsApp Web and show QR + connection logs."],
+	["openclaw message send --target +15555550123 --message \"Hi\" --json", "Send via your web session and print JSON result."],
+	["openclaw gateway --port 18789", "Run the WebSocket Gateway locally."],
+	["openclaw --profile team-a gateway", "Compatibility flag example: warns and still runs with --profile dench."],
+	["openclaw gateway --force", "Kill anything bound to the default gateway port, then start it."],
+	["openclaw gateway ...", "Gateway control via WebSocket."],
+	["openclaw agent --to +15555550123 --message \"Run summary\" --deliver", "Talk directly to the agent using the Gateway; optionally send the WhatsApp reply."],
+	["openclaw message send --channel telegram --target @mychat --message \"Hi\"", "Send via your Telegram bot."]
+];
+function configureProgramHelp(program, ctx) {
+	program.name(CLI_NAME).description("").version(ctx.programVersion).option("--dev", "Compatibility flag; DenchClaw always uses --profile dench and ~/.openclaw-dench").option("--profile <name>", "Compatibility flag; non-dench values are ignored with a warning");
+	program.option("--no-color", "Disable ANSI colors", false);
+	program.helpOption("-h, --help", "Display help for command");
+	program.helpCommand("help [command]", "Display help for command");
+	program.configureHelp({
+		sortSubcommands: true,
+		sortOptions: true,
+		optionTerm: (option) => theme.option(option.flags),
+		subcommandTerm: (cmd) => {
+			const hasSubcommands = cmd.parent === program && ROOT_COMMANDS_WITH_SUBCOMMANDS.has(cmd.name());
+			return theme.command(hasSubcommands ? `${cmd.name()} *` : cmd.name());
+		}
+	});
+	const formatHelpOutput = (str) => {
+		let output = str;
+		if (new RegExp(`^Usage:\\s+${CLI_NAME_PATTERN}\\s+\\[options\\]\\s+\\[command\\]\\s*$`, "m").test(output) && /^Commands:/m.test(output)) output = output.replace(/^Commands:/m, `Commands:\n  ${theme.muted(ROOT_COMMANDS_HINT)}`);
+		return output.replace(/^Usage:/gm, theme.heading("Usage:")).replace(/^Options:/gm, theme.heading("Options:")).replace(/^Commands:/gm, theme.heading("Commands:"));
+	};
+	program.configureOutput({
+		writeOut: (str) => {
+			process.stdout.write(formatHelpOutput(str));
+		},
+		writeErr: (str) => {
+			process.stderr.write(formatHelpOutput(str));
+		},
+		outputError: (str, write) => write(theme.error(str))
+	});
+	if (hasFlag(process.argv, "-V") || hasFlag(process.argv, "--version") || hasRootVersionAlias(process.argv)) {
+		console.log(ctx.programVersion);
+		process.exit(0);
+	}
+	program.addHelpText("beforeAll", () => {
+		if (hasEmittedCliBanner()) return "";
+		const rich = isRich();
+		return `\n${formatCliBannerLine(ctx.programVersion, { richTty: rich })}\n`;
+	});
+	const fmtExamples = EXAMPLES.map(([cmd, desc]) => `  ${theme.command(replaceCliName(cmd, CLI_NAME))}\n    ${theme.muted(desc)}`).join("\n");
+	program.addHelpText("afterAll", ({ command }) => {
+		if (command !== program) return "";
+		const docs = formatDocsLink("/cli", "docs.openclaw.ai/cli");
+		return `\n${theme.heading("Examples:")}\n${fmtExamples}\n\n${theme.muted("Docs:")} ${docs}\n`;
+	});
+}
+
+//#endregion
+//#region src/cli/program/preaction.ts
+function setProcessTitleForCommand(actionCommand) {
+	let current = actionCommand;
+	while (current.parent && current.parent.parent) current = current.parent;
+	const name = current.name();
+	const cliName = resolveCliName();
+	if (!name || name === cliName) return;
+	process.title = `${cliName}-${name}`;
+}
+function registerPreActionHooks(program, programVersion) {
+	program.hook("preAction", (_thisCommand, actionCommand) => {
+		setProcessTitleForCommand(actionCommand);
+	});
+}
+
+//#endregion
+//#region src/cli/program/program-context.ts
+const PROGRAM_CONTEXT_SYMBOL = Symbol.for("openclaw.cli.programContext");
+function setProgramContext(program, ctx) {
+	program[PROGRAM_CONTEXT_SYMBOL] = ctx;
+}
+
+//#endregion
+//#region src/cli/program/build-program.ts
+function buildProgram() {
+	const program = new Command();
+	const ctx = createProgramContext();
+	const argv = process.argv;
+	setProgramContext(program, ctx);
+	configureProgramHelp(program, ctx);
+	registerPreActionHooks(program, ctx.programVersion);
+	registerProgramCommands(program, ctx, argv);
+	return program;
+}
+
+//#endregion
+export { buildProgram };